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A MAINTENANCE MODEL FOR K-OUT-OF-N SUBSYSTEMS 
ABOARD A FLEET OF ADVANCED COMMERCIAL AIRCRAFT 

by 

Douglas R. Miller 


Proposed highly reliable fault- tolerant reconfigurable digital 
control systems for a future generation of commercial aircraft consist 
of several k-out-of-n subsystems. Each of these flight-critical sub- 
systems will consist of n identical components, k of which must be 
functioning properly in order for the aircraft to be dispatched. Failed 
components are recoverable; they are repaired in a shop. Spares are in- 
ventoried at a main base where they may be substituted for failed compo- 
nents on planes during layovers. Penalties are assessed when failure 
of a k-out-of-n subsystem causes a dispatch cancellation or delay. 

A maintenance model for a fleet of aircraft with such control systems 
is presented. The goals are to demonstrate economic feasibility and to 
optimize. (This is a preliminary report of ongoing research.) 
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1. Introduction 

This memorandum is a preliminary report about ongoing research 
and development of a cost model for maintenance/maintainability of pro- 
posed highly reliable fault-tolerant reconfigurable digital control 
systems aboard a future generation of commercial aircraft. 

Fault- tolerant digital control systems will allow for more efficient 
fuel usage, longer fatigue life, and bad weather operation on future air- 
craft. It is necessary to check that the savings so generated will not 
be offset by the increased Initial costs, maintenance costs and penalties 
due to dispatch criticality of such control systems; in other words, is 
the system economically feasible? To this end, a model is developed to indi- 
cate, prior to actually using the system, the economic impact of maintaining 
such a control system. This paper presents such a maintenance model and 
suggests ways to analyze it. 

The advanced avionics control systems under consideration are en- 
visioned as consisting of several types of components, each replicated 
several times to achieve fault- tolerance and high system reliability. 
Components will include CPU’s, memories, busses, input-output units, sen- 
sors, actuators, and possibly additional units, depending on the particular 
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architecture under consideration. (Two such systems are currently in 

the development stage: the SIFT computer of Stanford Research Institute 

and the FTMP of Charles Stark Draper Laboratories.) In general, let us 

say there are s types of components: n of type 1,..,, n of type s. 

X s 

The minimum number of replicates of each type necessary to perform certain 
computing loads will be given by a performance model of the computer/control 
system. If the system consists of this number of replicates and suffers a 
failure, it will no longer be able to perfoirm all its functions. Thus for 
system reliability considerations additional replicates of each type of 
component shall be included in the system. A reliability model in con- 
junction with the performance model will give, among other things, the 
minimui: number of replicates of each type of component required for re- 
liable operation of the system; a typical reliability constraint will be 

-9 

for the probability of catastrophic failure to be less than 10 . For 

example, it may require k replicates of component type 1, k^ of type 

2, etc. Presumably the Federal Aviation Agency (FAA) will adopt these 
k-values for the minimum dispatch complement of functioning components 
in the system. One almost certain result of a maintenance model will be 
that an economically optimal system, from a maintenance point of view, will 
consist of more than the minimum dispatch complement of components, i.e., 
n^ > k^ . Thus in designing the system, maintainability must be considered 

in addition to meeting a minimum reliability constraint. This fact is il- 
lustrated by a greatly simplified example in Appendix A. An optimal system 
is obtained by adding extra replicates of some components but not others; 
the decision is dictated by the mean lifetime of the components, the cost 
of the componenus, and financing considerations. 

In general, then, we have a system consisting of n^ replicates 

of component i , i=l,2,...,s . If fewer than k^ are functioning properly, 

then the system cannot be dispatched. Thus, the system can be modelled as 
s k-out-of-n subsystems in series configuration, [1]. The goal of the 
maintenance operation is to minimize system failure (nondispatch) by 
ensuring that there are always at least k^ good copies of component type 

i , 1=1, 2,..., s , in the system. Exponential lifetimes are assumed. 
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Maintenance of this system is supported by line maintenance centers 
located at some of the cities served by the airline; spares will be provi- 
sioned at these centers. Also supporting the maintenance operation will 
be one repair shop with a certain repair-rate capacity. Whenever enough 
failures accumulate to prevent dispatch, the plane is grounded and un- 
scheduled maintenance must be performed; otherwise, the maintenance is 
performed during scheduled overnight stops at line maintenance centers. 

No preventive maintenance is performed. 

Our goal is to predict the costs incurred in maintaining such an 
avionics control system. Once an entire system is specified, i.e., the 
detailed computer architecture and its maintenance support system, many 
of the costs can be Incorporated into a total cost function in a straight- 
forward way; for example, cost of spares, cost of repairmen, and overhead 
costs for the line maintenance center. Any such fixed costs are simply 
added together. However, costs which are incurred randomly due to events 
such as flight delays or cancellations, diversions, late arrivals, etc., 
cannot be included in the total cost of operating the system unless the 
long run average frequency of such events is known or can be predicted. 
Because such systems have never been flown, such frequencies are unknown 
and must be calculated from a probability model. This brings us to the pur- 
pose of this paper: namely, to find an analytically tractable model which 
approximately describes the stochastic behavior of the above control system 
and supporting maintenance activity. 

The time-dependent behavior of the system is fairly complicated. 

The state space consists of billions of points. Analysis appears impossible. 
To circumvent this apparent difficulty, we shall break the large problem 
into a number of smaller ones which interface with one another. We shall 
"uncouple" in three ways. 

1. We shall treat one type of component at a time. This gives s 
separate processes which correspond to k^-out-of-n^ systems 
which have failures and undergo repair. 

2. We shall break the total operation of one of these k-out-of-n 
systems into suboperations: for example, (i) operation of the 
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components over the airline route structure, (ii) provisioning 
of spares at line maintenance centers, (iii) operation of the 
repair shop, and (iv) acquisition and inventorying of nonrecov- 
erable subcomponents. Each of these suboperations can be mod- 
elled by itself: (i) a birth-and-death process, (’ii) an allo- 

cation problem, (iii) a cyclical machine repair operation, and 
(iv) an inventory problem. Steady-state behavior can be deter- 
mined for each suboperation. We shall use this to approximate 
the steady-state behavior of the entire system by analysis of 
the interfaces between the suboperations. An example of un- 
coupling queueing networks is that of Jackson queues [7]. 

3. We shall consider economic penalties resulting from poor main- 
tenance (nondispatchabillty) separately from economic penalties 
resulting from unreliability, i.e., problems arising on a plane 
which met dispatch requirements at the start of the flight leg. 

Given a certain control system and its supporting maintenance system, 
we can then determine the approximate rate of occurrence of certain random 
events related to maintenance and reliability. The costs incurred by these 
events will generally depend upon where and when they occur in the airline 
route. However, over the long run the proportion of events which occur in 
one city or flight leg will be proportional to the length of time the plane 
spends in that city or flight leg; thus from the route structure and indi- 
vidual costs it will be possible to obtain average costs incurred for a 
particular random maintenance or reliability event. These can then be 
incorporated into general cost equations. 

When a cost model is created, the next step will be optimization. 

There are various control variables which can be set to values that achieve 
economic optimality. 

The specific model presented in this paper is a snecial case of 
spares provisioning and control with recoverable units. There exists some 
literature in this general area; see References [4], [5j, [10], and [14]. The 
current situation, however, has two features which do not appear to have 
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been considered previously In problems of this type; namely, the k-out- 
of-n feature and the scheduled routine maintenance tiroes. Other general 
maintenance models are found In [1] and [11]. 

The model presented here focuses on maintenance. There are other 
factors which should be considered In a complete cost model that are not 
addressed here. 

1. Costs of different hardware designs. 

2. Costs of software and software maintenance. 

3. Allocation of components Into line replacement units (LRU's). 

4. Detailed aspects of airline accounting procedures, tax situa- 
tions, etc. 

5. Savings due to increased fatigue life. 

6. Juggling the route structure, e.g., "switching tail numbers." 

7. Costs of test equipment. 

The reader is reminded that the model has many simplifications in it. It 
is intended as a prototype to explore and develop methodologies and to gain 
insight into modelling one aspect of airline costs. If it is success .1, 
a more realistic extended model can then be developed. 

2. The Model 


The following simplified situation is modelled in this paper. The 
airline consists of a fleet of N planes. Aboard each plane there is a 
k-out-of-n subsystem; for example, n identical CPU's in the flight control 
system, k of which are required to be operating for dispatch. It is assumed 
that the n units fail independently of one another; each has an exponential 
lifetime with failure rate A . It is assumed that failures are detected as 
they occur; there are no latent failures. Each of the components is a line 
replacement unit (LRU); individual failed components are replaced when the 
opportunity arises. 

All routine maintenance of the k-out-of-n system is performed at 
one main base. This base includes a line maintenance center, a repair shop, 
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and a pool of spare components. Each plane in the fleet is scheduled for 
an overnight stop at the main base at intervals of D days (or equivalently, 
T flight hours) . At this time failed components are replaced by good com- 
ponerts from the spares pool; the failed components are sent to the repair 
shop where they are repaired and then added to the spares pool (se'i Figure 1). 
There are s spare units; thus at any time there will be a total of s 
units in the repair shop and spares pool. There are r repairmen or repair 
channels in the repair shop; the repairmen work an eight-hour day from 8:00 
a.m. to 5:00 p.m. , say. The repair rate per day per repairman is ]i , i.e., 
the number of units repaired by a repairman in one day has a Poisson distri- 
bution with mean y , provided he is kept busy all day. Equivalently, the 
repair time for one unit is exponential with rate y . 

A spares strategy is specified for dealing with the possibility 
that there are insufficient spares in the spares pool to meet demand. Any 
demand from a plane whose system has dropped below k functioning units 
is considered an "emergency" demand because such a plane cannot be dis- 
patched unless a replacement is made. Thus, whenever such a demand is made, 
a number of spares sufficient to restore the system to k functioning units 
is released if there are any spares available in the spares pool. If such 
an event occurs while the plane is away from the main base, the plane is 
grounded there until the spare parts are flown out to it; it then continues 
on its scheduled flight plan. It greatly simplifies the analysis if only 
minimal repairs (restore system to k operating components) are allowed 
away from the main base; therefore we shall make that assumption in this 
simplified model. The demands made on the spares pool by planes during 
their scheduled overnight stop at the main base will be considered "routine." 
When the spares pool is low it may not be optimal to fill all such demands. 

In general, if a system requests d replacement components and y units 
are available in the spares pool, f(d,y) units will be released from the 
spares pool. We shall consider two special cases. First, a hoarding level 
h is set. All "routine" requests are filled which do not deplete the 
spares pool below h ; other requests are denied; f^(d,y) = d if y-d 

h , = y-h if h < y < h+d , and =0 if y ^ h . The second spares 
strategy will be more general; it is the same as above except that vfhen 
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d = n-k at least one spare will be released if available: f^(d,y) = d 

if y-d ^ h , = y-h if h < y < h+d , =1 if d = n-k and 1 £ y £ b , 
and =0 if d < n-k and y _< h . Let 6 be a control variable (equal 
to 0 or 1) which corresponds to the two cases above, then 

if y-d ^ h 

if h < y < h+d 

if d = n-k , ^ y ^ ^ 

if d < n-k . 1 1 y £ h 

if y < 1 . 

It is possible to let 6 equal other values, but restricting it to 0 or 
1 will illustrate the method of analysis. Recall that demand from a system 
with fewer than k operating components is considered an "emergency” and 
thus in the above equation for "routine" demands we do not consider d > n-k 

Another consideration in this model is the route structure of the 
airline. It is assumed that each of the N planes flies the same schedule 
staggered by a one-day time delay so that, in effect, the planes are follow- 
ing each other on a path throughout the system, making a complete cycle in 
vT hours or vD days, where v is the number of planes scheduled for over- 
night stops at the main base each night. We assume that v is an integer; 
for example, for the United 747 fleet, v = 1 . In addition to the main base 
the route will consist of several primary bases and secondary bases. \'Jhile 
flying the route a plane cannot be dispatched if fewer than k components 
in the k-out-of-n system are functioning. If the system drops below k 
functioning units in the course of a flight this fact is noted and the plane 
is grounded at its destination until a replacement is made, bringing the 
system back to k or more functioning components. The penalty for grounding 
at a primary base reflects lost time and the cost of sending a spare from the 
main base. The penalty for grounding at a secondary base includes these 
factors plus the cost of flying in a maintenance man to make the replacement. 
The penalty costs are developed more fully in Sections 4 and 5 of this 
treatise; it is assumed there that groundings are distributed statistically 
over the route according to the schedule. Thus it is necessary in the 
present analysis to keep track only of how many occur. (This is an example 
of uncoupling.) 
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The state of the airline and its maintenance support at any time is 
described by the number of components functioning in the k-out-of-n sub- 
system on each plane and the number of spares in the spares pool; it is an 
N+1 dimensional vector. Consider the number of units functioning in a 
single k-out-of-n system over the interval [0,T] , i.e., the time in- 
terval to complete one cycle of the route, main base to main base. Let 
Z(t) equal the number of components of the k-out-of-n system functioning 
at time t (accumulated flight time since departure from the main base) . 

A representative sample path of Z is depicted in Figure 2a, and the cor- 
responding approximation to be used in modelling is given in Figure 2b. 

It will be much easier to analyze the approximate behavior depicted in 
Figure 2b. 

The paths in Figures 2a and 2b correspond to the following behavior. 
The system is dispatched from the main base with k+3 components of the 
k-out-of-n system functioning. The first three failures have no effect on 
dispatchability. At time t^ a failure occurs reducing the system to k-1 

functioning components; it is therefore grounded at the completion of the 
flight leg, time . It loses t^ - flight hours waiting for a spare 

and resumes its flight plan at time t^ . The approximate model (Figure 2b) 

assumes instantaneous repair although a penalty will be assessed to corres- 
pond to the flight time lost in Figure 2a. This approximation will be con- 
servative because it exposes the system to more risk, indeed it is possible 
for the approximate system to suffer another failure (at time t^ ) while 

the true system’s operation is suspended. At accumulated flight time t^ 

another failure occurs and before completion of the leg (at t^ ) a second 

failure occurs (at t^ ); after a delay the flight is resumed at tg . In 

the approximation the two failures are assumed to be repaired instantly; a 
penalty is assessed for each separately. This will be a conservative approx- 
imation because the penalty for two separate events will be greater than the 
penalty for one event of two failures; with reliable components the failure 
of two in one flight leg will be very unlikely, therefore only a small 
error is introduced by this approximation. Another failure occurs (at t^ ) 
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Figure 2. — A sample of the state of the k-out-of-n system process and approximation Z. 
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on a flight leg which ends at t^^ at an overnight stop where it is 

possible to fly in a spare and make the replacement without losing any 
flight time. The failure is noted in the approximation in Figure 2b; 
the fact of no lost, time will be reflected in the statistical distribution 
of failures over the route structure that is presented in Section 4. 
Similarly, a failure occurs at time t^^^ on the leg terminating at the 

main base. This failure occurs in the approximation in Figure 2b; the 
fact that there is no penalty for lost time or grounding will again be 
accounted for by statistically distributing the failures over the route 
structure in order to assess penalties in Section 4. The approximation 
in Figure 2b should result in only a very slightly higher cost due to the 
small likelihood of its differiLng greatly from the true behavior in Figure 
2a. The process in Figure 2a is a rather complicated birth-and-death pro- 
cess which is difficult to treat analytically; however, the process in 
Figure 2b is much simpler. It is a pure-death process with absorbing state 
k ; after being absorbed at time T^ , its failures occur according to a 

Poisson process. The state of the ith plane will be denoted , 1=1, 

2,...,N . 

The number of spares available in the spares pool will be denoted 
by Y . There are three distinct activities related to the spares pool: 
restocking with output from the repair shop, depletion due to "emergency” 
demand (units required to restore subsystems to k operating units) , and 
depletion due to "routine" demand (requests from planes during scheduled 
overnight stops at the main base to increase their number of functioning 
units from k or more). Roughly speaking, the first activity takes place 
during the day, the second later in the day, and the third at night. It 
will be convenient for modelling purposes to apportion the three activities 
into nonoverlapping time intervals of morning until evening, evening until 
night, and night until the following morning. The size of the spares pool 

at these times will be denoted , and Y^ , respectively. A repre- 

sentative sample path over several days is depicted in Figure 3, where a 
negative value of Y corresponds to unfilled "emergency" demand. 
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We desire more than one possibility for analyzing this system; 
thus, in addition to considering as a process over [0,T] , we shall 

also divide it up according to time of day. Let rep- 

resent, respectively, the state of the subsystem on the ith plane when it 
is dispatched in the morning, when it completes service for the day (num- 
ber of components operating plus the number of emergency demands) , and 

N M 

after emergency repair is made. Note that Z equals Z for the next 
day except for a plane remaining overnight at the main base. Let equal 

the number of groundings (or emergency demands) made during the day by the 
ith plane. 

The basic probability laws governing the above processes will be 
presented in Section 3 and the solution for steady-state probabilities 
discussed in Section 4. Before proceeding we shall summarize the notation 
introduced up to this point. 

N planes in the fleet 

1 k-out-of-n subsystem aboard each plane 

n components in the subsystem 

k components must be functioning for dispatch 

X failure rate per hour per component 

1 central line maintenance center (at main base) 

T flight hours per plane between scheduled overnight stops at main base 

D days per plane between scheduled overnight stops at main base 

Y planes visit main base each night for overhaul 

1 repairshop 

r repairmen at shop 

s spare units 

]i repair rate per day per repairman 

h hoarding level of spares pool 

6 minimum number of replacements for system with n-k failures 

Z^(t) number of components functioning aboard ith plane at time t 
M 

Y size of spares pool in early morning 

g 

Y size of spares pool after restock before emergency demand 
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N 

Y size of spares pool after emergency demand before routine 

demand 
M 

state of ith plane at first dispatch in morning 
E 

state of ith plane at end of flying day 
number of groundings of ith plane 


Note that vD = N and N/v - D , so the average number of hours flown 
each day is T/D = vT/N per plane. Actually, the model can easily incor- 
porate different flight times each day; ^2 ^ ^ ‘ ‘ ~ ’ 

For the time being we shall consider only the case where D - N and v = 1 . 


In the above list of variables, n , r , s , h , and 6 are control 
variables. They will be set in order to optimize sou?e economic objective 
function. In addition to these variables, in Section 5 we shall introduce 
the possibility of maintaining buffer spares pools, whose sizes can be con- 
trolled, at the primary bases. 

3. The Underlying Probability Laws 

In this section various transition probabilities and other stochastic 
relationships are derived for the Y and Z processes. Various subsets 
of these probabilities can be used for different analytic approaches. For 
the appropriate background material in probability and stochastic processes, 
see References [2], [3], [8], and [13]. 

3.1 Q^: Z(0) ^ Z(T) 

The quantity Z(0) equals the number of functioning components 
aboard a plane when it is dispatched after its overnight stay at the main 
base, and Z(T) equals the number of components working when it returns 
for its next ovemight/maintenance visit to the main base. Thus the transi- 
tion Z(0) -*■ Z(T) reflects the deterioration of the system in [0,T] , 

recalling that k is an absorbing state. Let be the matrix of these 

transition probabilities; 
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Thus 



» P{Z(T)»j I Z(0)»1} . 


P{i-j failures out of i in [0,T]} , 
P{i-J or more failures in [0,T]} , 


if j > i 
if i ^ j > k 
if i > j = k . 


Using the fact that a component with failure rate \ will fail with prob- 
ability 1 - exp (-XT) in the interval [0,T] yields 



3.2 Q^: Z(T) Z(0) 

The transition Z(T) ->■ Z(0) corresponds to "routine" replacements 
of failed components during the scheduled overnight visit to the main base. 
If X failed components are replaced, then Z(0) = Z(T) + x . The number 
X of failed components replaced depends on three things: the number of 

failures in the k-out-of-n system, n - Z(T) ; the number of spares 

N 

available in the spares pool, Y ; and the strategy for releasing spares 
from the spares pool, . Tlius the transition probabilities for Z(T) to 

N 

Z(0) may depend on the value of Y . Define 

= P{z(0)=j I Z(T)=i, Y^=y} . 

It follows that this is actually a deterministic transition 

1 , if f^(n-i,y) = j-1 

0 , otherwise. 

In some Instances it may be possible to approximate the transition prob- 
abilities of Z(T) to Z(0) by assuming that Z(T) and Y^ are 
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independent when steady state Is achieved. In "light traffic," i.e., 
little demand on or depletion of the spares pool, this approximation 
of independence might be reasonable. (It is discussed in Section 4.) 
Let 

p”(y) = P{Y^=y} 


be the steady-state marginal probabilities of Y . Assuming independence 
N 

of Z(T) and Y (i.e., the demands of one plane have little influence 
on the distribution of the number of units in the spares pool) gives 

= P{Z(0)=j I Z(T)=i} 


y 


ij ly 


Nr ^ 

p (y) 


3.3 




zM ^ (z®,G) 


M 

Suppose a plane starts its flight day with Z good components. It 

E 

flies for t hours, then Z is the number of good components at the end of the 
flight day ( t hours). It is assumed that emergency replacements prevent 
E 

the value of Z from falling below k ; G equals the number of such 
emergency replacements. (Note that we are bending the rule about emergency 
demands depleting the spares pool at the end of the day, after it has been 
restocked by the repair shop. It is believed that this will not have a 
significant effect, as it is only a small perturbation along the time axis.) 

E 

The possible values taken by (Z ,G) are depicted in Figure 4. Note 

E M 

that G is nonzero only when Z = k . Let Q be the matrix of transition 

, ME 

probabilxties for Z -> (Z ,G) , 

^i,(j,g) " P{(Z^»G) = (j,g) 1 . 

First consider the case i^j>k , G = 0 
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= P{i-j failures out of i in [0,t]} 
= P{j survivors out of i in [0,t]) 



Now consider the case 
by conditioning over 



T, 


> 3 = k . In this case we shall compute Q. 
, the absorption time by state k given that 


(k,g) 


Tj^ = inf(t ; Z(t)=k| . 

The distribution of derived by noting that it is the time until 

the (i-k)th failure, thus 


F (t) = P{T < t 1 Z^W} 

T, 1 Z =i ^ 

k I 

= P{k or fewer survivors in [0,t]} 


I (i - 

3=0 ' 

M 

The conditional density of T^^ given Z =i is 



M 

Returning to Q and using a conditional probability argument: for 

g > 1 , i > k , 
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= f P{G=g I T =s}f (s)ds 

0 T, Iz =1 

k' 


= / e-w(t-s) , [ia (t -s j. i« , 

0 T^^|z”=l 


J ^( ) 

j=0 


i|e-kXt 


(kA)g 

6* Jo 


X ji / (t-s)® e 

I 0 


g As(k-j-m-l) 


ds - j / (t-s)° e 

0 


g Xs(k-j-m) 


The above is obtained via substitution and the Binomial theorem. This 
expression can be evaluated by noting that 

\g cts, ^g+1 at g -(at)u, 

/ (t-s)^ e ds = t* e / u^ e du , 

0 0 


and that 

} g -6u . . -8 r 8^"^ 

/ u e du = g! e J (e+i)i • 

0 i=l 

In actual applications it will be possible to truncate the values of g 
to perhaps g £ 2 or 3 because with reliable components it will be very 
unlikely to have more than one or two failures in one day's flight time. 
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Finally consider the case 1 - k : 


^k, (k,g) 


= e 


?{Z^=k, G=g I Z^=k} 

P{g events of Poisson process In [0,t]} 
-kAt (kXt)^ 




Let be the random variable equal to the proportion of time 

during [0,T] that Z(t) equals k . This is the time when the k-out- 
of-n system is susceptible to a failure which causes an "emergency.” 

= (T-Tj^)'*'/T , 

where is the passage time defined in 3.3 and = max(0,x) . 


‘‘k, z 


e(r^ ! Z(0)=z) 

■| e((T-Tj^)‘^ I Z(0)=z) 


integrating by parts. Using the formula for jz(0) gives 

k 
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k,z 




T k 

r I 

0 m=0 

= U □ ^ dt 

m=0 '”' 0 

= I I (!)/T(-l)"e-^^e^«dt(-» 
^ oio 0 lio I i 

1 y lz\K“ i 1 - 

' ^Jo(")jo -- ^ 1 ^ )■ 


The steady-state expected proportion of time the k-out-of-n 
system Is In state k will depend on the steady-state distribution 
of Z(0) . Let 

q®(l) = P{Z(0)=1) 

when the system has reached steady state. Then 

\ = e((I-T^)+)/T = I rl q“(z) . 

z 

This quantity will be of Interest because If we are dealing with components 

which fall Infrequently, the point process of "emergency" failures will be 

approximately a Poisson process with rate proportional to r . 

<c 

3.5 m^(t) = E(G(t) 1 Z(0)=z) 

Let G(t) be the cumulative number of "emergency" failures of the 
Z process in the time Interval. Calculation of the conditional expected 
value of G(t) is similar to the analysis in 3.4. Conditional on Tj^ = 

s < t , G(t) is a Poisson random variable with mean Xk(t-s) ; if Tj^ > t , 

G(t) is identically 0 , a dagenerate form of the Poisson distribution. 

Thus G(t) is a mixture of Poisson random variables, the mixing distribution 
being |z(0)=z * truncated at t . Thus the expected value of G(t) will 

be the same mixture of expected values 
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o^(t) - / 

t 

= Xk t r, f 
k,z 

from 3.4. Similarly, if the system has reached a steady-state behavior, 
the cumulative expected number of failures will be 

m(t) = E(G(t)) = I m^(t)q°(z) « Xk t r^ . 

z 

This quantity will be useful in statistically distributing the "emergency" 
failures over the route structure in order to compute the average cost of 
an emergency failure. 

3.6 ■> 

By an assumption of the model, any change in the spares pool during 
the period morning -to -evening is a result of restocking from the repair 
M 

shop. Let P be the matrix of transition probabilities, for i»j ^ 0 , 

^ij " I 

= P {repair shop output = j-i j s-i units in shop) 

= R . . , 

s-x,s -3 

where R is the matrix of transition probabilities for the repair shop: 

Rg equals the probability that m units will remain in the shop at the 

end of the day given that were in the shop at the beginning of the day. 
Let L(t) equal the number in the shop at time t (time is measured in 
days). Then 

R^ ^ = P{L(r)=m 1 L(0)=«.} . 

The process {L(t), 0 _< t < l) is a pure-death process with transition 
intensities, for i ^ 1 , 

P{L(t+At) = i-1 I L(t)=i} = min(i,r)V At , 
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where time Is measured as fraction of working day. Consider the following 
cases. 

Suppose 1 > r ; then define l*^i 2**’**'^r first passage 

times to states i-l,i-2, . , . ,r , respectively: 


= lnf(t : L(t) = 1-1) , etc. 

If L(0) = i and i > r , then ^ has an exponential distribution with 

failure rate ry . Similarly, has an exponential distribution 

with rate ry provided Jl >1 t . For ^ r , has a gamma (ry, 1-Ji) 

distribution and 

P{lCD>JI I L(0)=i} = P{T^ > 1} . 

This is the same probability as for a Poisson process with rate ry ; thus 
must be the same for j ^ r as for a Poisson process, i.e., 

R. . = i {Poisson (ry) process has i-j events in [0,1]} 

-ry (ry)^"^ 


= e 


(i-j) I ’ 

Now consider the case i > r, j < r , 


i > j > r . 




= / P{L(l-t)=j I L(0)=r}f^ j^^Q^^^(t)dt , 

where is the first passage time to state r . The T^ has a Gamma 


(ry, i-r) distribution with density 

1 

(i-r-1) ! 


1 / ^i-r-1 -ryt „ 

f(t) = - (ry) t e , t > 0 . 


Also 


P{L(l-t)=j I L(0)=r} = (^|(e - e ^ . 
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Substituting these expressions into the equation for R. . and Integrating. 

i > 3 

using the equality 


f. -at 

/ e t dt 


v! n -a r 

V+1 p- " ® n ’ 

g L r=0 J 


yields 


m=0 [(r-m-j)vi] L n=0 ’ J 

. (^1 (ry)^”^ 

+ V 3 ./ A -1. 

^ '• (i-r)! ® 


Finally, consider the case i £ r ; then 

= P(L(l)=j i L(0)=i) 




i-j 


= (j)(e-‘‘) ll- e->^) . 


We have now given R. . for 0 ^ j _< i , the only nonzero values. Re- 

X, j 

turning to P^, , it should be noted that is allowed to take negative 

values to reflect unfilled emergency demand. We follow the convention of 
not returning a failed component to the repair shop before it is replaced 

by a good component from the spares pool, thus < 0 Implies exactly s 
spares in the repair shop and 


i»3 


R . . , 

s-i,s-j 

if 

i 

> 0 

R , 

s,s-j+x 

if 

i 

< 0 . 


3.7 P^ : Y® Y^ 


The transitions of the spares pool in the evenlng-to -night period 
is assumed due to emergency demand. It is assumed that the system is op- 
timized in such a way that emergency demands are relatively Infrequent; 
this suggests a Poisson distribution of the number of emergency demands. 

As mentioned in 3.4, the expected number of such demands will be proportional 
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to the proportion of time the planes spend in the "danger" state k , 

T 

namely r^^ . More specifically, the mean number of emergency demands In 

a day will be proportional to the number of flight hours spent in state 

T 

k by the fleet, namely N(vT/N)rj^ . Since k components with failure 

rate X are subject to failure under this circumstance, the mean number 
of emergency demands in one day Is 

V = vTr^Xk . 
k 

E 

Thus, letting P be the matrix of transition probabilities. 



P{Y^=j I Y^=i} 


P {emergency demand = l~j) 



j > 1 
j £ i . 


N N M 
3. 8 P : Y Y 

The transitions In the spares pool during the time interval from 
night to the next morning are assumed due to replacements made on the 
plane (or planes) visiting the main base for their scheduled overnight 

N 

maintenance. Let P be the matrix of transition probabilities of deple- 
tion of the spares pool by one such visitor. If there is more than one 
visitor then this transition is iterated once for each visitor and 

(P^)^ ; Y^ The number of spares taken from the spares pool depends 

upon the number requested, n - Z(T) . Thus as in 3.2, there exists a de- 
pendence between Y and Z . As before, we shall assume that the depen- 
dence can be uncoupled in the steady state, 

|Z(T)==: - I 

1 , if j-i = fg(n-z,l) 

0 , otherwise 
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and If the probabilities of Z(T) in the steady state are 

= P{Z(T)=z} , 

then steady-state transitions are approximately 

P?. = P{Y”=j 1 Y^=i} 

— V 

^ ij|z(T)=z^z * 
z 

3.9 Joint Probability Laws for Z and Y 

In Sections 3.1 through 3,8 only marginal distributions of Y and 
Z are presented. Any dependence between Y and Z was assumed to be 
weak enough that any joint probabilistic behavior could be approximated 
by mixing over the marginals; for example, the transitions in 3.2 of Z 
depend on Y so the conditional transitions were mixed, weighted by the 
distribution of Y when the system (airline operation) is in steady state. 
Analysis in 3.8 is similar. This approach of attempting to uncouple Y 
and Z in this manner is quite unconventional and some justification for 
it must be given. 

In contrast to this tentative "uncoupling” approach, we now pre- 
sent the exact probability laws for a fleet of N aircraft flying an N-day 
route pattern, i.e. , one visitor per night at the main base. A schematic 
of the stochastic behavior of this system from one morning until the next 
morning is presented in Figure 5. Referring to that figure, note the fol- 
lowing: On a given day the planes are numbered 1,2 N , corresponding 

M 

to the day of the route pattern the plane is on; for example, Z^^ equals 

the number of functioning components in the k-out-of-n subsystem on the 
plane which is starting the first day of the route, i.e., the plane that 
has just completed its scheduled overnight at the main base. There are 
t^ flight hours in the ith day of the route pattern. The transition of 

E N 

the spares pool from evening to night, Y -> Y , is actually a deterministic 
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Figure 5. — Schematic of exact transitions for fleet of N planes flying 
an N day cycle. Arrows signify transitions; broken arrows indicate joint 
probability effect in transitions. 
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N E r 

transition: Y = Y - broken arrows in Figure 5 denote the 

1=1 

N N E 

fact that Y also depends on the J also , 1=1, 2,..., N . 

The transition of the spares pool between evening and the next morning 

are joint with Z^ , in particular (Y^, Z^) •+ (Y^, Z^) is given by 

M N M N N N 

Y =Y - X, Z^ = Zjj + x, where x = f^Cn-Z^j, Y ) ; this transition 

M N 

is also deterministic. Finally = Z^ , i=l, 2, . . . ,N-1 . The only 

stochastic transitions occur during the time Interval from morning until 
evening; the transition probabilities for these are given in 3.6 and 3,3. 

The remaining transitions are deterministic as described above. 

4. Steady-state Behavior of the Airline System 

The goal of this study is to determine long-run average costs of 
maintaining the k-out-of-n systems on the fleet of aircraft over the life- 
time of the fleet, approximately 20 years. We shall assume that the system 
reaches a steady state quickly relative to this 20-year length of time, and 
therefore the long-run average behavior of the system starting from new 
can be accurately approximated using steady-state probabilities. Thus these 
probabilities must be obtained. Tliis section is devoted to some approximate 
or tentative approaches to this problem. Future work will include more 
thorough investigation of these and other possible approaches. 

4.1 Uncoupling Y and Z 

One possible approach to solving for steady-state probabilities is 
to assume that the dependence between Y and Z can be uncoupled. More 
specifically, when the system is in steady state we assume that for Z 
transitions, which are conditional upon the state of Y , it suffices to 
use the weighted sum of these conditional transition probabilities, weighted 
by the steady-state marginal distribution of Y ; and vice versa for Y 

T 

transitions. Such weighted sums occur in the transition matrices Q and 
N 

P , in 3.2 and 3,8, respectively. 
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The uncoupled analysis Is shown in Figure 6. Ttie Z process Is 
analyzed separately from Y ; It only uses a steady-state distribution 
N N N 

of Y as an Input. Let p (1) = P{Y =1} be a steady-state distribution 
N 

of Y . For purposes of deriving the steady-state distribution of Z It 


N 

is assumed that p Is given and fixed independently of the stochastic 

T N 

behavior of Z ; the transition matrix Q is actually a function of p : 
T T N 

Q “ Q (p ) » Section 3.2. If the steady-state probabilities of Z(0) 

0 T 

and Z(T) are q and q , respectively, 

q°(z) = P{Z(0)=z} 

q'^(z) = P{Z(T)=z} , 

then they must satisfy 


T 

q 


q Q 


0 

q 


q Q (p ) 


(4.1.1) 


Thus in order to obtain steady-state probabilities of the Z process, we 

N 

first must supply a steady-state distribution for Y and then solve the 
system of equations (4.1.1). Quantities of interest arising from the Z 
process (see Figure 6) are emergency demand and routine demand for spares. 

As discussed in Section 4.4, the emergency demand when the system is in 
steady state may be approximately a Poisson process with rate proportional 
to r^^ . Routine demand equals n - Z(T) and therefore its distribution 

T 

is obtained from q for the system in steady state. 

The Y process requires steady-state distribution of emergency and 
routine demands for spares as input. Therefore assume that the emergency 
demands form a Poisson process with rate V . As in the previous paragraph, 
it is assumed that this input process is independent of Y . The transition 
E EE 

matrix P actually depends on V , P = P (V) , see Section 3.7. Next we 
assume that the demand process for routine replacement of failed parts is 
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IT r 

a sequence of Independent demands » where the steady-state 

distribution is 

P{D^=d} = q*^(n-d) . 

N T X N T 

Thus the transition matrix P actually depends on q , ?* = P (q ) » 

see Section 3.8. If the steady-state probabilities of , and 

Y are p , p , and p , respectxvely, 

P^(y) = P{Y%} 

p^(y) = P(Y^=y} 

p”(y) = P{Y^=y} , 

then they must satisfy 


E M„M 

P = P P 

p” = pV(v) (4.1.2) 


Thus, in order to obtain steady-state probabilities for the Y process, it 
is necessary to provide steady-state distributions of spares demand. 


The above analysis of the Z process corresponds to the upper half 
of Figure 6. It is assumed that the Input processes are given and controlled 
so that behavior of the Z process creates no feedback which can affect the 
distribution of these inputs. Similarly, the above analysis of the Y pro- 
cess assumes no feedback to the input process. These analyses of the pro- 
cesses separately as described are valid; however, now we suggest the ques- 
tionable technique of analyzing them simultaneously with the above methods. 

In particular the output of Z becomes the input of Y and vice versa, 
creating a feedback loop that violates the previous assumptions. It is 
hoped that in some cases of Interest this will not be a serious violation 
and approximate steady-state probabilities can be obtained. 
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Combining the separate analyses of Z and Y gives the following 
system of equations: 

T 0-0 

q = q Q 

q = q Q (p ) 

V T 0, . 

Z 


“k 

E 


= pV 


(4.1.3) 


N 

P 

M 

P 

V 


pV(v) 

pV(q'^) 

TrfXk . 

k 


This system can probably be solved iteratively, or perhaps by using a 
matrix inversion computer algorithm. 


The uncoupled analysis described in this section is intended as 
an approximation. It is highly unlikely that it will produce exact steady- 
state probabilities for any system of interest. The approximation might be 
good in "light traffic," i.e., excess spares or repair facilities. It also 
might be a good approximation in the case where the mean repair time is 
much shorter than D , the number of days in one cycle of the route structure 
this case would tend to have little dependence between the size of the spares 
pool at a particular time and the number of spares requested by an overnight 
visitor at the main base. 

Future work will include a closer look at the above technique. In 
Appendix B a simple example with some numerical results is presented which 
illustrates the fact that the above uncoupling technique may give incorrect 
answers. 


4.2 Partial Uncoupling of Y and Z 

The uncoupled analysis in Section 4.1 amounts, in some sense, to 
ignoring the joint distributions of the different components of the 


32 - 



TM-66502 


vector-valued process and just allowing marginal distributions to enter 
into the analysis. In Figure 6 the only information allowed to cross the 
interface (the dotted line in Figure 6) between the Y and Z processes 
are the marginal distributions. We can extend this idea of uncoupling by 
allowing more but not all information to cross the interface, in particu- 
lar some of the joint probabilities between Y and Z , but not all. 

This idea is only in the formative stages and is not precise. The follow- 
ing example may help. 

Let , Y^ , Y^ , Z(0) , Z(T) , and be defined as in previous 

sections. Define the following joint transitions of (Y,Z) . In the 

M E 

moming-to-evening time period (Y , Z(0)) ->• (Y , Z(T), G) , according to 
the transitions given in 3.3 and 3.6. In the evening -to-night period, 

(Y^, Z(T), G) (Y^, Z(T)) , where Y^ = Y^ - G , a deterministic transition. 

N 

Finally in the night-to-momlng period we have the transition (Y , Z(T)) 

(Y^, Z(0)) , where Y^ = Y^ - x and Z(0) = Z(T) + x , x being 
N 

fg(n - Z(T), Y ) . The three transition matrices can be multiplied to give 

M 

the transition of (Y , Z(0)) from one morning to the next, and then steady- 
state joint probabilities can be solved for from the eigenvector equation. 

We note that, while the uncoupling in 4.1 ignored dependence and thus 
may have removed some of the Interaction and reduced some of the fluctua- 
tions in the behavior of the system, the analysis in this section may have 
the opposite effect, thus providing an approximation with higher operating 
cost than the one in 4.1, which may have a lower operating cost. The reason 
for increased fluctuations is the fact that the above analysis is equivalent 
to making one plane fly the whole N-day route in one day Instead of having 
N planes staggered out on the route. Having all the emergency failures of 
a plane charged on the day it is dispatched from the main base aggravates 
any shortage in the spares pool; if the pool was low the plane was dis- 
patched in less than perfect condition, thus stochastically increasing the 
number of emergency failures the plane will suffer in the next N days. 

If these failures are all charged to the spares pool on the first day, it 
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will Increase the chance of a stockout over the case of charging them 
on the day they occur because the repair shop will have less time to 
catch up on its work. 

Another possible treatment of the interface between the T and 
Z processes would be to allow only information on the total number of 
bad units among those in planes and in spares to cross the interface, 
then to assume a statistical distribution of the number of bad in each 
plane and at the base, conditional on the total number of bad units in 
the entire system. 

4.3 Sparse Matrix Techniques 

Consider the transitions of (Y,Z^, . . . ,Zj^) described in Section 3.9. 

The state space of this process will be huge. As an example, consider the 
United 747 fleet of 18 aircraft with CSDL microprocessor aboard; this has 
10 CPU's. Suppose that 6 (2 triads) must be functioning for dispatch, 
giving a 6-out-of- 10 system; suppose there are 10 spares; then ignoring 

18 13 

backorders, the state space consists of (10+1) (10-6+1) = 4.2 x 10 

points. Any straightforward Markov analysis is clearly infeasible; however, 
as is pointed out in Section 3.9, there are actually a much, much lower 
number of transitions within this huge state space than can occur in general. 
This suggests an analysis using sparse matrix techniques. The example in 
Appendix B should be amenable to such an approach; see the end of Appendix B. 
A recent reference is [12]. 

4.4 Monte Carlo Simulation 

In spite of the size of the state space it is probably feasible to 
perform a Monte Carlo simulation of the system in Section 3.9. This is 
because stochastic transitions of Individual components are independent of 
each other and all joint transitions are deterministic. Another fact 
favoring success of a Monte Carlo approach is that we are interested only 
in a subset of marginal probabilities and a subset of expected values to 
be used as inputs in the cost equations (see Sections 5 and 6). The first 
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fact suggests that Implementation Is tractable; the second that run times 
until reaching equilibrium of quantities of Interest will be of manage- 
able length. 

It will be of interest to run a Monte Carlo simulation starting 
with a perfect new system and to note the length of time required for 
the system to reach equilibrium. If the equivalent real operating time is 
10 years or so (a significant part of the lifetime of the system) , this 
obviates the need for a steady-state analysis of the system. In that 
case, transfer ts must be considered. 

Fin' ily, Monte Carlo simulation of the exact system (in Section 
3.9) can be used to evaluate the accuracy of the approximate solution tech- 
niques proposed in Sections 4.1 and 4.2. If the accuracy is questionable, 
it might be efficient to use the approximate solution techniques to obtain 
initial vectors for a Monte Carlo simulation. Conversely, if the approxi- 
mate solution probability vector is used as an initla?, vector in the simula- 
tion and after several iterations the marginal probabilities have not 
changed appreciably, this constitutes verification of the approximate 
solution approach. 

5. Interface with Reliability and Cost Models 

In Sections 2 through 4 the underlying stochastic behavior of a fleet 
of aircraft with k-out-of-n subsystems is described along with proposed 
methods of analysis. This underlying stochastic behavior generates events 
that have consequences in the realm of reliability penalty costs and 
maintenance penalty costs. We distinguish between these two penalty situa- 
tions as follows. A maintenance' penalty event consists of dispatch cancel- 
lations or delay of a plane due to the k-out-of-n system dropping below 
k functioning units on the previous flight leg and inability of line main- 
tenance men to replace failed component (s) prior to the next dispatch time. 

A reliability penalty event occurs when a plane is dispatched on a flight 
leg with k or more units functioning at dispatch time but during the 
course of the flight something happens which prevents the aircraft from 
completing the flight according to flight plan. Reliability penalty events 
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include abortions, diversions, delayed arrivals, excess fuel consumption, 
crashes, etc. The penalties Incurred will depend upon where in the route 
pattern the particular event occurs. To compute the average penalty costs 
Incurred by operating the airline in steady state during a time Interval, 
we shall compute a weighted average of average cost per penalty event 
occurring at each point of the route pattern, weighted by the expected 
number of events at that point during the time interval. 


5.1 The Route Schedule and Penalty Costs 

The route pattern of a D-day, T-hour route can be described 
by a 4 X ra array in which m equals the number of legs in one cycle 
through the route: 




where a^ is the ith city visited, d^ the day of the D-day cycle, 

t^ the accumulated number of flight hours when landing at the ith city, 

and g^ the amount of ground time at the ith city. For example, consider 

the route depicted in Figure 1. A possible route schedule for this situa- 
tion is: 


/ 2 3 

4 

5 

3 

6 

7 

2 

8 

7 8 1 

I 1 1 

1 

2 

2 

2 

2 

3 

3 

3 4 4 

1 2.0 4.5 

6.0 

7.3 

8.3 

11.3 

12.9 

16.0 

19.7 

21.2 22.7 25.7 

\l.O 2.5 

14.5 

.9 

1.5 

2.0 

12. 7 

2.0 

1.7 

12.0 3.5 16.0 y 

Labelling the 

main base as 

City 

#1, in the 

above 

array 

we have 3 legs on 

the first day 

of the 

4- day 

cycle 

: 1 

^ 2, 

2^3, 

3 

4, with cumulative 

flight time equal to 

6. 0 hours. 

The 

second 

day starts 

with a leg 4-^5 


Now we wish to assign costs to reliability and maintenance penalty 
events which can occur in the course of flying the route. These costs will 
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be a function of where the event occurs in the route. First consider 
maintenance penalty events; the only such event is an emergency failure, 
i.e., the k-out-of-n subsystem dropping below k functioning con^ionents. 
As an example, suppose an emergency failure occurs at cumulative flight 
hour 10.0 in the above route schedule; this means that during the second 
day on the leg from City //3 to City #6 the k-out-of-n subsystem drops 
to k-1 functioning components. It is assumed that the dispatch minimum 
level of k working components is conservative and that the plane 
can complete the flight leg as planned with only k-1 units; however, 
a failed unit must be replaced at City y/6 before the plane can be dis- 
patched on the next leg of the route. We assume that all spare units 
are inventoried at the main base and thus a replacement must he flown 
out to City #6; furthermore, if City #6 is a secondary base, a maintenance 
man must be sent to make the replacement. Time required to get the spare 
and make the replacement may exceed the 2-hour ground time at City #6, 
interfering with dispatch of the next leg, 6 ->■ 7 . Consequently this leg 
may be cancelled or delayed. If it is cancelled the cost may be computed 
as proportional to the length multiplied by the size of the plane; depending 
upon the amount of airline information available it should, in principle, 
be possible to compute the cost to any desired precision. Delay costs can 
also be calculated from airline experience. If a spare is available from 
the main base inventory the problem should be fixed in time for the plane 
to get back on schedule to start day #3. If the last leg of day '-2 is 
cancelled, a ferrying cost will be incurred in getting the plane from City 
#6 to City #2. All the penalty costs resulting from an emergency failure 
on the sixth leg, i.e., 3 6 , are deterministic and in theory can be 

calculated to give a cost C^ . Likewise similar costs can be computed 

for an emergency failure on any leg. This information can then be used to 
give the penalty cost resulting from an emergency failure at time t 
flight hours; denote it C (t) , A possible example of G„(t) for the 

El h 

above 4-day route schedule is plotted in Figure 7. The steady-state 
expected cumulative number of emergency demands in (0,t] is calculated 
in Section 3.5: m(t) = E(G(t)) . Therefore the average cost due to emer- 

gency failures on one plane in [0,T] for an airline operating in steady 
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state Is a weighted sttm o£ the costs, weighted by the expected number of 
times each cost Is incurred. Let C equal this average cost; then 


= / C (t)dm(t) . 

0 ^ 


Now consider the reliability penalties Incurred by a plane flying 

a scheduled route. A reliability penalty event can be any of several 

possibilities, each with a different penalty cost; thus we shall assume 

we know the expected reliability penalty cost Incurred when a plane is 

dispatched on the ith leg of the route schedule with z components in the 

k-out-of-n subsystem working correctly. Denote this quantity as ^„(z,i) 

R 

Let q^(z) equal the steady-state probability of the subsystem having z 

Then the expected penalty costs charged to 

reliability in the course of a plane flying the route for an airline in 
steady state is 

m n 


good units at time t. - . 

1-1 


I I C (z,l)q^(z) . 
i=l z=k ^ 

The probability vector q is calculated from q^ , using the techniques 

of Section 3.1. The expected cost function C is related to work sup- 

R 

ported by a National Aeronautics and Space Administration (NASA) grant 
with the University of Michigan (John Meyer, Principal Investigator); 
thus we shall not pursue it here. 


Any further discussion of reliability is beyond the scope of this 
memorandum. However, there is a rather compelling reason for not consider- 

-Q 

ing It in this preliminary effort at a cost model; namely, if the 10 
reliability con-itraint is met, it is very difficult to Imagine such a 
control system causing great economic penalties due to unreliability. 


-9 


in a 10-hour 


Consider that the chances of loss of control are 10 

flight; thus approximately 10"^° in a 1-hour flight. If we take the 
extremely conservative view that 1 in 100,000 cases of reliability failure 
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events will Involve loss of control that still implies at most 10 
probability of some sort of reliability problem in 1 hour. For a fleet 
of 100 planes operating 10 hours per day* 365 days per year, this results 
in 3.65 expected reliability penalty events each year. The expected 

_5 

number of cases involving loss of control will be 3.65 x 10 . The 

economic Impact of such rare events will be small in the average day-to- 
day costs of running the plane. The extremely rare catastrophic event 
can be incorporated by simply estimating the cost per event and multi- 
plying by the expected frequency, e.g., $100,000,000 x 3.65 x io“^ = 

$3650 , and adding this figure to the annual cost. (The above reasoning 
is rather imprecise, but it should justify ignoring the economic impact 
of reliability penalty costs for now; we shall assume that k is fixed 

-9 

at a level for which the 10 probability constraint is met.) 

5.2 Buffer Spares Pools at Additional Airports 

One of the simplifying assumptions in the model in this paper is 
the existence of a single solitary spares pool located at the main base. 

It is assumed that when a plane’s k-out-of-n system drops below k good 
components away from the main base that a spare is flown out to it from 
the main base. In actual airline operations some spares are also distributed 
at certain primary bases in addition to the main base. In this section we 
show how to incorporate such a feature into the model of Sections 2 and 3 
without complicating the analysis of the underlying stochastic behavior. 

This approach is intended to apply to very small spares pools at only a 
very limited number of additional airports. In effect these additional 
spares pools will act as buffers for emergency spare demand. If a plane 
is grounded at an airport with a buffer spares pool, a spare is used from 
that pool to replace a failed component (which is assumed returned to the 
repair shop by the next morning), then a demand is placed to the main base 
for a spare to restock the buffer pool. Tliis demand is treated as an emer- 
gency demand by the main base and filled within one day if spares are 
available; if no spares are available at the main base, a backorder is re- 
corded (the Y process goes negative). Tliere is no transshipment between 
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buffer spares pools. The spares in a buffer pool are used only for 
emergency replacements at the airport where the buffer pool is located. 

The only modification required in the model will be in the cost terms 
for penalty for stockout of the spares pool at the main base and delay 
cost. Most of the backorders arising from demands for spares from air- 
ports with buffer spares pools will not reflect a true emergency (a 
grounded plane with no spare available) , but simply a shortage in the 
buffer pool. Thus the penalty for stockout of the main spares pool must 
be decreased by a factor proportional to the percentage of demands which 
do not reflect true emergencies. Thus we must compute the fraction of 
demands which come from an airport with a buffer pool when there is no 
plane waiting for a spare. 

To illustrate the above situation, consider an airline route with 

one buffer spares pool consisting of at most one spare at a primary base. 

Presumably this will be a base with relatively heavy traffic. For example, 

in Figure 1 of Section 2, we shall put a buffer spares pool of size one 

at City #7 . For an airline flying this route according to the schedule 

in Section 5.1 in-steady state, the expected number of emergency demands 

placed by a plane at City #7 equals dm(t) Integrated over flight legs 

dt 

7 and 10, 

m^ = ( m(12.9) -m(11.3)) + (m(21.2) -m(19.7)) 

If there are N planes flying a I>-day schedule then the total expected 
demand at City #7 will be m^N/D = . Since the buffer pool will be 

placed at an airport with a lot of traffic it is assumed that the dally 
emergency demand for spares can come from many planes; it is therefore 
reasonable to assume that the demand has a Poisson distribution with mean 
daily demand M^ . It takes one day to restock the buffer pool, thus 

we need the proportion of demands which find a spare present. This is a 
case of Palm'^s theorem [6]; it will equal the probability that no demand 
was made in the last 24-hour period. If the demand is Poisson with mean 
per day, then the distribution of time since last demand (LD) is 

exponential with rate and 
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P{LD >1} = exp(-M^) . 

Thus proportion exp(-M^) of the demands arriving at the main spares 

pool from City #7 are not really emergencies and no penalty should be 
incurred for failure to fill them Immediately. These constitute pro- 
portion 

p* = M^exp(-M^) / (N/D) m(T) 

of the total expected demand on the spares pool at the main base. In 
Section 6, the term for the penalty for stockout of the main base spares 
pool should be decreased by a factor of p* . Also, the penalty for an 
emergency failure at the airport with the spares buffer must be reduced, 
since less delay is involved in proportion exp(-M^) of the cases. 


6. Cost Equations 

The average quantities derived from the stochastic behavior of the 
maintenance operation and costs associated with them can now be combined 
with other costs to form a fairly general model of the cost of acquiring 
and maintaining the system and its backup for a fleet of aircraft. 


We first consider fixed initial costs. The initial purchase cost of 
units plus spares is 

C = N(C . + C ,n) + C „s . 

P P.O p,l p,2 

The cost of setting up the repair shop is 

C = G ^ + C ,r . 
s s,0 s,l 

Certification and training costs for repairmen and line maintenance men is 
C = C n ^ .r + C „ (// primary airports) . 

The total initial cost will be 


C. = C + C + C . 
1 p s c 
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Next consider fixed continuing costs. The shop overhead is 
The salaries of repairmen are 


C = rC 1 . 
r r,l 

The retraining/recertification cost of repairmen is 

"t - "t,0 + • 

The overhead cost of the line maintenance center at the main base and the 
line maintenance centers at other bases which are charged to this sub- 
system are 

C = C n + ^ primary) + C ,, (# secondary) . 

m m,0 m, 1*^ ■’ m,2 ^ 

The annual fixed costs .-ire the sum 

C. = C- + C + + C . 

f 0 r t m 


The present value of fixed costs when the system is new is 

y-1 


= C. + I (l-d)''c^ , 
n=0 


where d is the annual discount factor and y is the lifetime of the 
system in years. 


Finally, we consider the costs which are incurred daily in a random 
fashion during the life of the system due to the underlying stochastic 
nature of the system. The expected daily cost of emergency groundings 
for the fleet (due to repair and lost revenue) is 

Cg = (N/D)C^ , 

where C_ is defined in Section 5.1. The expected daily cost due to 
h 

stockout of the spares pool is equivalent to one day of lost service 
for each item short for a day. If the average stockout is 

N = E([Y^]“) = -I ip^ , 

i=-N ^ 
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I 


and R, Is the average dally revenue per plane, then the expected dally 
d 

penalty for stockout Is 


^SO^^d 


(If a buffer spares pool consisting of one unit Is added to the system 

as described in Section 5.2, then the following modifications must be 

made to the cost equations: C* = (l-p*)C . C must be adjusted to 

dU so £ 

reflect lower grounding penalties at the airport with buffer. If C, » 

b , u 

is the expected daily penalty at this airport without a spare available 

and C, is the penalty if a spare is always immediately available, then 
b,l 

the expected daily savings by having the buffer is A = exp(-M^)Cj^ ^ + 

(1 - exp(-M_))C, „ and C* = C_ - A ; C, , and C, » can be computed 

/ DjU £ £ DjU 

as described in Section 5.1. Finally, the cost of the extra spare must 
be added to C , C* = C + C „ .) 

p p p p,2 


Line maintenance charges at the main base may be a linear function 
of the average number of bad units and the average number of replacements 
made on each aircraft visiting on a scheduled overnight stop. The average 
number of bad units on a plane is 

~ ^ T 

B = n - EZ(T) = n - i zq . 

z=k ^ 

The average number of units replaced on a plane is 

R = E(Z(0)) - E(Z(T)) = I zq° - I zq^ . 

z=k ^ z=k ^ 

Thus the daily expected line maintenance cost is 




There may be some feature where repairmen in the shop can work on other 
things if they are not busy repairing components for this particular system. 
The expected number of idle repairmen is 
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_ r-1 ^ 

1 - I ('-«Ps-i • 
r=0 

and the credit for each is , creating an expected credit 

^IR " * 

is 


above should include 
is the possibility of 
testing for latent 

7. Conclusions 

It is premature to make any definitive concluding remarks about 
the model and analysis discussed in this memorandum because the research 
is still in progress. However, we shall summarize some of the assumptions 
made in the model, all of which turn out to be of a conservative nature, 
and outline some future work. 

7 . 1 Conservatism of the Model 

There are numerous instances where the model only approximates 
the behavior of an actual airline maintenance operation as it exists in 
the real world. In these cases we have chosen the approximation so that 
it tends to overestimate the cost (or number of failures, etc.), thereby 
giving a lower bound on performance of the system for particular values 
of the control variables; that is, in the real world we are assured of 
doing as well or better. Some instances of these conservative approxima- 
tions are: 


The daily expected costs due to stochastic behavior 


^ST S ^SO ^LM " ^IR * 


The total cost is 


yzi 


C + C + I (l-d)^365C 

^ ^ I 


n=0 


ST 


There are undoubtedly other sources of cost but the 
many of the major ones. (One thing we have ignored 
periodic — say, every 10,000 hours — extensive ground 
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(a) Only minimal emergency repair is allowed when the system 
drops below k functioning components away from the main 
base. 

(b) There is only one spares pool (located at the main base) . 

(c) The spares strategy is special; a more general one might re- 
sult in lower operating costs. 

(d) Only one line maintenance center is allowed to do routine 
replacement. 

(e) The system is required to complete all T flight hours 
even if some legs are cancelled, thus exposing the system 

to more time on test than it gets in the real world and thus 
increasing the chance of failures. 

(f) There is no flexibility in the repair shop such as overtime 
work in order to reduce stockout. 

(g) It is assumed that an entire day is lost if the replacement 
demand by a grounded plane is not met because of stockout. 

(h) It is assumed that all units of the k-out-of-n subsystem 
have the same failure rate as a component in use, even 
though some components may be in a standby configuration. 

(i) If the number of functioning units drops from k to k-2 
during one flight leg, the event is counted as two groundings 
and costed as such in the cost equations. 

(j) There is no dispatch flexibility; for example, airlines ■ tend 
to allow a plane with k-1 good units to be dispatched to 
the main base. We do not. 

There is at least one nonconservative aspect to our model; we ignore 
the possibility of component failures on the ground or in the stockroom^ 
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7.2 Future Work 

(a) An attempt will be made to solve the model with realistic 
parameter values numerically on the computer. 

(b) Some theoretical work will focus on justification for inter- 
facing stochastic processes in the way presented here, e;g.. 
Sections 4.1 and 4.2. 

(c) Some optimization will be attempted. The control variables 
are n , r , s , h , and 6 . Economic feasibility of an 
optimal solution will be examined. 

(d) If we get computer output for a sufficient number of different 
parameter values, we shall do some sensitivity analysis and 
possibly eliminate some of the model's complexity. One 
approach is Repro-modellng [9]. 
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APPENDIX A 

A Simplified Trade-off Example 

In this section we describe several variations of a flight control 
system and perform a greatly simplified economic analysis of the mainte- 
nance of each system to illustrate trade-offs between redundancy and per- 
formance. 

Suppose that in order for a control system to control the aircraft 
it requires a minimum of 6 processors, 6 memories, 2 buses, 2 each of 
sensors A, B, and C, and 2 each of actuators 1, 2, 3, and 4. If the 
control system consists of this minimum set of components then a single 
failure causes loss of control. We shall assume that memories and processors 
have mean times between failures (MTBE’ s) of 10,000 hours and all the other 
components have MTBF's of 100,000 hours. We shall denote the above system as 

Miricontrol " * 

Now consider dispatchability. We use the requirement that the 

-9 

probability of loss of control in a 10-hour flight cannot exceed 10 . 

Using elementary calculations involving binomial probabilities we compute 

P{drop to 5 or fewer processors in 10 hrs | start with 8} 

w [^j(l - 10"^) (l0~^) = 56 X lO"^ > lO"^ 

p{drop to 1 or fewer buses in 10 hrs | start with 3} 

a (l)(l - 10"^) = 30 X 10“^ > 10“^ . 

Thus if the control system consists of only 8 processors and memories and 
3 each of buses, each sensor and each actuator, it cannot be dispatched. 
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PAGS BLANK NOT FBiNSB 

Control System Penalty/Fllght Hour (x 1000) 


Min,. ^ . 
dispatch 


GS, 


CS 


II 


CS 


III 


(4 X 10"^] 

1 + 2I 

[9 X 10"'^) 

= 2.12 X 10"^ 

(4 X 10"^ 1 

1 + 2I 

[2.25 X lo"^) 

= 3.65 X lo""^ 

(5 X 10"®] 

1 + 2I 

[9 X lo"'^) 

= 1.80 X 10“^ 

(5 X 10"®] 

1 + 2I 

[2.25 X 10"^ ) 

= 4.54 X lo"^ 


Now consider the repair costs per flight hour. Let us assume 
that the average repair cost of a memory or a processor is $1,000 and the 
average repair cost for a bus, sensor, or actuator is $500. A 4-out-of-4 

system with MTBF 10^ for each component has failures at the rate of 
4 X 10 ^ per flight hour, a 4-out-of-5 system has failures at approxi- 
mately the rate of 5 x 10 ^ per flight hour. A 9-out-of-9 system with 

4 -4 

MTBF 10 for each component has failures at the rate of 9 x 10 per 

flight hour; a 9-out-of-lO system has failures at approximately the rate 

-4 

of 10 X 10 per flight hour. Thus the average expected repair costs per 
flight hour for the different systems is; 


Control System 


Repair Gost/Flight Hour (x 1000) 


Min 

dispatch 


CS, 


CS 


II 


CS 


III 


3(4 X lo"^| X .5 + 2(9 X lo""'*) XI = 1.96 X 10 "^ 

3(4 X 10 “^) X .5 + 2(10 X 10 "^) X 1 = 2.16 X 10~^ 

3(5 X 10 "^| X .5 + 2(9 X 10 “^) XI = 2.00 X 10 “^ 

3(5 X 10 “^) X .5 + 2(10 X 10 "^) X 1 = 2.20 X 10 "^ 


Adding the above costs (grounding plus repair) gives the cost of maintenance 
per flight hour. 
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Control System Maintenance Cost/Fllght Hour ($) 


dispatch 

4.08 

CSi 

2.53 

“ll 

3.80 

*^^111 

2.21 


The last system is clearly cheaper to maintain, but it will be the most 
expensive. Assume that an extra memory and processor costs $5,000 and 
that adding an extra bus, 3 extra sensors, and 4 extra actuators costs 
$10,000. Then the extra cost is 

Control System Additional Cost 


dispatch 

0 

CSi 

5,000 


10,000 


15,000 


If the additional cost is spread over 12 years with 10 flight hours per day 
(43,800 flight hours) these additional costs become 

$.114 $.228 and $.342 

per flight hour for CS^, CS^^, and respectively. These costs 

musL be paid initially and thus it might be more accurate to amortize the 
initial investment over the 12-year period assuming an 8% interest rate. 

In this case the additional cost per flight hour is Increased by a factor 

r .08 


/ 1 

1 ( ^ V 

ll+r) 

^ U.08/ 


12 


= 1.59 


and the values become 


$.364 


and 
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per flight hour for CS^, CS^j, and respectively. 

Now consider the total difference in costs for the four systems 
(maintenance cost per flight hour plus Initial Investment per flight 
hour) . 


Control System 


A Cost/Flight Hour ($) 
Amortized Not Amortized 


dispatch 

4.08 

4.08 


2.71 

2.64 


4.16 

4.03 


2.76 

2.55 


Thus CSj is optimal if we consider the cost of financing or of having 
money invested in equipment; optimal if we Ignore this factor. 

This illustrates how accounting procedures could have a significant effect. 

The above example is meant only for illustrative purposes. The 
analysis is too simple to be successful with a real control system. 
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APPENDIX B 

Uncoupling and Sparse Matrices; An Example 

A simple specific example of a stochastic process is presented which 
may lend itself to approximate uncoupled analyses and also to sparse ma- 
trix techniques. It is intended to be used as an example for developing 
methodologies in the above areas. 

Consider a bivariate continuous- time process {X(t), Y(t), t ^ 0} ; 
the process is Markovian. Let n be an integer time point. In the inter- 
val [n, n+1) the transitions of X and Y are Independent of each other. 

Here X is a pure-death process on [n, n+1) with state space {0,1,2,. ., ,b} , 
and X can be thought of in connection with a b component system: X(t) = 

number of functioning units in the system at time t . The transition in- 
tensities for X are 

P{X(t+At) = i-1 j X(t) = i} « iXAt , 

for n<t< t+At < n+1 ; 1=1, 2,.,,, a ; 0 is an absorbing state during 

[n, n+1) . 

Similarly let Y be a pure-birth process on [n, n+1) with state 
space (0,1,2,. ..,c} . Here Y can be thought of as the number of con^o- 
nents in a spares pool. If the repair shop that fixed the failed components 
from the X-proc.-ss has c repairmen, then the transition intensities of Y are 

P{Y(t+At) = i+1 j Y(t) = i> = (c-i)yAt , 
for t < t+At < n+1 ; i=0,l,2, . . . ,c . 

At integer time points the system whose state is described by the 
X-process is repaired by replacing failed components with good components 
from the spares pool. This transition is completely deterministic. 


- 56 - 


TM-66502 


(X(n”), Y(n")) -»» (x(n), Y(n)) , 

where 

X(n) = X(n") + r , Y(n) = Y(n") - r 

and 

r = mln|b - X(n ), Y(n )J . 

The process (X,Y) Incorporates some of the features of the more 
general processes In which we are interested and thus may be a useful ex- 
ample for studying the possibilities of uncoupled analysis. We consider 
a special case (b=l, c=l) to show that uncoupled analysis gives incorrect 
answers. In future work it may be possible to determine the approximate 
size of the error introduced by this approach in more general situations. 

Consider the special case of (X,Y) with X = 0 or 1 and Y = 

0 or 1 , At integer time the process can be in one of four states, 

(0.0) » (0,1) , (1,0) , or (1,1) . Suppose that during one unit of time 
a good unit in the system described by X has probability p of failing 
and a unit in the repair shop has probability q of being repaired. 


Then in the interval 

[n, n+1) the 

! following transition probabilities 

hold: 


P{X(n+l“)=0 

1 X(n)=l} = p 


P{X(n+l”)=l 

1 X(n)-l) = 1-p 


P{X(n+l”)=0 

1 X(n)=0} = 1 


P{X(n+l”)=l 

1 X(n)=0} = 0 

and 


P{Y(n+l")=0 

1 Y(n)=l} =0 


P{Y(n+l“)=l 

1 Y(n)=l> = 1 


P{Y(n+l")=0 

1 Y(n)=0} = 1-q 


P{Y(n+l”)=^l 

1 Y(n)=0} = q . 


The joint transition matrix for (x(n), Y(n)) to |x(n+l”), Y(n+l)~| is 
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P 



q 

1 

pq 

p 


0 

0 

(l-p) (l-q) 
0 



The joint transition matrix for (x(n ), Y(n )) to |x(n), Y(n)j is 



The joint transition matrix for |x(n), Y(n)j to (x(n+l), Y(n+l)| is 


PQ = 



0 q 

0 1 

0 pq+(l-p) (l-q) 

0 p 



The steady-state probability vector for the process {(x(n), Y(n)j, 
n=0,l,2,...| is the solution of 


r = rPQ . 

For the special case p = .1 and q = .5 , the steady-state joint dis- 
tribution of (x(n), Y(n)j is 

P{X(n)-0, Y(n)=0} = ^ 

P{X(n)=0, Y(n)=l> = 0 

P{X(n)=l, Y(n)=0> = ^ 

P{X(n)=l, Y(n)=l} = 4~ . 


If an "uncoupled" analysis is performed in order to approximate 
the marginal steady-state probabilities of X and Y (an analysis similar 
to that described in 4.1), the following is obtained. Let 
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» P{X(n)=l} , 1 - = P{X(n)*0} 

Py = P{Y(n)=l} . 1 - Py = P{Y(n)=0} 

be the notation for marginal probabilities in steady state. The condi- 
tional transition probabilities for X(n) to X(n+1) are 

P{X(n+l)=0 I X(n)=l, Y(n)=0} = p(l-q) 

P{X(n+l)=0 1 X(n)=l, Y(n)=l> = 0 , 

and so on; thus, when mixing using the assumed steady-state distribution 
of Y(n) we get the "unconditional" transition probabilities 



P{X(n+l)=0 ! 

X(n)=l} = 

(l-py)p(l-q) + Py*0 


P{X(n+l)=l I 

X(n)=l} = 

(1-Py) [d-p)+pq] + Py*l 


P{X(n+l)=0 1 

X(n)=0} = 

(l-Py)d-q) + Py‘0 


P{X(n+l)=l 1 

X(n)=0} = 

(l-Py)q + Py*l . 

Similar 

computed 

"unconditional" 
for Y ; 

steady-state transition probabilities can be 


P{Y(n+l)=0 

1 Y(n)=l} 

= (l-p^)l + p-p 


P{Y(n+l)=l 

1 Y(n)=l> 

= (I-P^)O 4- P^(l-p) 


P{Y(n+l)=0 

1 Y(n)=0} 

= (l-Pjj)l + pj^tl-q+pq] 


p{Y(n+l)=l 

1 Y(n)=0} 

= (1-ppO 4- p^[(l-p)q] . 

For the 

special case p 

= . 1 and 

q = .5 , these transition values become 




V.5 - .5 
\.05 - .05p 


.5 + .5 p \ 

y\ 

.95 + .05p / 




1 - .45p^ .45p^ 

1 - . 9 p . 9 p 
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for the marginal X process and Y process, respectlyely. The steady- 
state probability vectors were thought to satisfy 


(1-P^» p ) 

= (l“P^» 

X X 

X 

(1-Py, Py) 

= (1-Py, 


Solving the above system gives 


Py)Ry ■ 


-t, + ^ 

18 


= .8022 


20 ^y 
9 1+P, 


= .9891 . 


The exact marginals for steady-state behavior are 


p(Y(n)=l) = -^ = .8036 

p(x(n)=l| = If = .9821 . 

The accuracy of the approximation raises a glimmer of hope that the un- 
coupling technique may be useful. 

The process (X,Y) may also be a useful example for investigating 
the application of sparse matrix techniques to solving for steady-state 
distributions. Note that the state space of the process has cardinality 
(b+1) (c+1) . A straightforward analysis would involve solving a system 
of (b+1) (c+1) linear equations in (b+1) (c+1) unknowns; a tedious task 
for moderate values of b and c , an impossible task for large values 
of b and c . However, recalling the underlying stochastic behavior 
of the system, recall that there are (b+l)(b+2)/2 possible transitions 
of X(n) to X(n+1 ) and (c+l)(c+2)/2 possible transitions of Y(n) 
to Y(n+1 ) , and that these transitions are Independent of each other 
and therefore joint probabilities contain no more information than the 
marginals. The transition of (x(n ), Y(n )| to |x(n), Y(n)) is deter- 
ministic and thus consists of (b+1) (c+1) bits of information. Thus the 
transition probabilities of (x(n), Y(n)| to (x(n+l), Y(n+l)j actually 
are generated by 


- 60 - 


M-66502 



(c+1) (c+2) 
2 


(b+1) (c+1) = (c+b+2)^(c-H?t3> 


values, which is much smaller than the number of entries in the transition 
matrix. 


[ (b+1) (c+1) . 

For example, if b = c = 10 , we are comparing 253 with 14641. It seems 
plausible that some sparse matrix techniques might be used to exploit 
this characteristic. 



